From 4223abfae604dd3ab16c809ca874610d71196012 Mon Sep 17 00:00:00 2001 From: Binary Wang Date: Mon, 29 Jul 2019 10:23:58 +0800 Subject: [PATCH] Upgrade com.thoughtworks.xstream:xstream to version 1.4.11 It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285) --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 49ccee65..80dc39f4 100644 --- a/pom.xml +++ b/pom.xml @@ -173,7 +173,7 @@ com.thoughtworks.xstream xstream - 1.4.10 + 1.4.11